Explain OpenCode provider failures in overview

[seonghobae]

Summary

• include OpenCode model provider HTTP status/message/URL evidence in OPENCODE_REVIEW_UNAVAILABLE overview comments
• keep unavailable review state non-blocking when all source checks pass
• add workflow source guard coverage

Verification

• actionlint .github/workflows/opencode-review.yml
• python3 scripts/checks/verify_supply_chain.py
• uv run --project services/analysis-engine pytest services/analysis-engine/tests/test_supply_chain_policy.py -q -k "opencode_review_unavailable or opencode_review_gate_ignores or pr_review_merge_scheduler_uses"
• uv run --project services/analysis-engine ruff format --check services/analysis-engine/tests/test_supply_chain_policy.py
• git diff --check

Security Notes

• Untrusted inputs: OpenCode JSONL output is treated as untrusted runtime evidence and parsed only for bounded status/message/URL fields.
• Trust boundary: the workflow does not convert provider failures into approval; it only updates the overview explanation.
• Safe failure: malformed or missing JSONL falls back to a generic unavailable summary instead of failing the approval step.
• Logging/privacy: no tokens or prompts are emitted; only provider status/message/endpoint metadata is summarized.
• Test points: source guard in test_supply_chain_policy plus actionlint and supply-chain verification.

[github-actions]

OpenCode Review Overview

• Head SHA: 3c9e75b1265f4dd21e8d3e3018b6c5245fd3c10c
• Workflow run: 27816549447
• Workflow attempt: 1
• Gate result: OPENCODE_REVIEW_UNAVAILABLE (approval step)

OpenCode Agent did not produce a valid review payload after all current-head GitHub Checks completed.

• Result: OPENCODE_REVIEW_UNAVAILABLE
• Reason: OpenCode review attempts did not complete or did not return a valid control block.
• OpenCode outcomes: primary=failed, fallback=failed, second_fallback=failed

OpenCode runtime evidence:

• primary model call failed with HTTP 401: Unauthorized: Unauthorized (https://models.github.ai/inference/chat/completions)
• fallback-r1 model call failed with HTTP 401: Unauthorized: Unauthorized (https://models.github.ai/inference/chat/completions)
• fallback-v3 model call failed with HTTP 401: Unauthorized: Unauthorized (https://models.github.ai/inference/chat/completions)
• Head SHA: 3c9e75b1265f4dd21e8d3e3018b6c5245fd3c10c
• Workflow run: 27816549447
• Workflow attempt: 1

No blocking review was submitted because this is an agent/runtime failure, not a source-backed code finding.